The vulnerability is a logic defect in macOS’s Gatekeeper system that enables an application to bypass built‑in code‑signing checks. When an unsigned or malicious package is allowed to run, it can execute with the privileges of the installing user, potentially compromising confidentiality, integrity, and availability. The weakness is an instance of improper access control, as it permits execution that Gatekeeper is explicitly designed to prohibit.

Apple macOS releases affected are macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6 and 26.7. Earlier or later releases are considered unaffected unless Apple explicitly notes otherwise.

An EPSS score of less than 1% indicates a very low, but non‑zero, likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploits are reported. The likely attack vector is local: a user who installs a package that has circumvented Gatekeeper checks, either through user interaction or by exploiting a configuration that permits unsigned applications. While the overall exploitation probability remains low in a well‑secured environment, the impact of a successful bypass is high, so timely patching is strongly advised.